rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
(detected by 1, t=10502 jiffies, g=617205, q=48)
rcu: All QSes seen, last rcu_preempt kthread activity 10502 (4295286621-4295276119), jiffies_till_next_fqs=1, root ->qsmask 0x0
rcu: rcu_preempt kthread starved for 10502 jiffies! g617205 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:28872 pid: 14 ppid: 2 flags:0x00004000
Call Trace:
context_switch kernel/sched/core.c:4322 [inline]
__schedule+0x911/0x21b0 kernel/sched/core.c:5073
schedule+0xcf/0x270 kernel/sched/core.c:5152
schedule_timeout+0x14a/0x250 kernel/time/timer.c:1892
rcu_gp_fqs_loop kernel/rcu/tree.c:2005 [inline]
rcu_gp_kthread+0xd07/0x2250 kernel/rcu/tree.c:2178
kthread+0x3b1/0x4a0 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 14493 Comm: syz-executor.3 Not tainted 5.12.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:pv_wait_early kernel/locking/qspinlock_paravirt.h:269 [inline]
RIP: 0010:pv_wait_node kernel/locking/qspinlock_paravirt.h:304 [inline]
RIP: 0010:__pv_queued_spin_lock_slowpath+0x59b/0xb40 kernel/locking/qspinlock.c:473
Code: 49 be 00 00 00 00 00 fc ff df 4d 89 ec 4c 89 3b 49 c1 ec 03 4d 01 f4 48 8b 74 24 20 b8 00 80 00 00 48 c1 ee 03 4c 01 f6 eb 32 <84> c0 75 23 41 0f b6 14 24 4c 89 e9 83 e1 07 38 ca 7f 08 84 d2 0f
RSP: 0018:ffffc90000007a38 EFLAGS: 00000246
RAX: 00000000000034e8 RBX: ffff8880b9d35f40 RCX: 0000000000000004
RDX: 0000000000000000 RSI: ffffed1017386be9 RDI: ffff8880b9c35f54
RBP: ffff8880b9c35f54 R08: 0000000000000001 R09: ffff8880b9c35f54
R10: ffffed1017386bea R11: 0000000000000080 R12: ffffed10173a6bea
R13: ffff8880b9d35f54 R14: dffffc0000000000 R15: ffff8880b9c35f40
FS: 00007ff15ac04700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000568000 CR3: 000000008ad5c000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:554 [inline]
queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
do_raw_spin_lock+0x200/0x2b0 kernel/locking/spinlock_debug.c:113
spin_lock include/linux/spinlock.h:354 [inline]
mac80211_hwsim_tx_frame_no_nl.isra.0+0x68f/0x1330 drivers/net/wireless/mac80211_hwsim.c:1514
mac80211_hwsim_tx_frame+0x14f/0x1e0 drivers/net/wireless/mac80211_hwsim.c:1775
mac80211_hwsim_beacon_tx+0x4ba/0x910 drivers/net/wireless/mac80211_hwsim.c:1829
__iterate_interfaces+0x1e5/0x520 net/mac80211/util.c:793
ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:829
mac80211_hwsim_beacon+0xd5/0x1a0 drivers/net/wireless/mac80211_hwsim.c:1852
__run_hrtimer kernel/time/hrtimer.c:1537 [inline]
__hrtimer_run_queues+0x609/0xe40 kernel/time/hrtimer.c:1601
hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1618
__do_softirq+0x29b/0x9f6 kernel/softirq.c:345
invoke_softirq kernel/softirq.c:221 [inline]
__irq_exit_rcu kernel/softirq.c:422 [inline]
irq_exit_rcu+0x134/0x200 kernel/softirq.c:434
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1100
</IRQ>
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:find_next_fd fs/file.c:464 [inline]
RIP: 0010:alloc_fd+0x21a/0x640 fs/file.c:485
Code: f7 a8 ff 8b 44 24 10 49 8d 7d 18 44 89 e6 48 b9 00 00 00 00 00 fc ff df 39 c5 0f 43 c5 89 c2 48 89 f8 48 c1 e8 03 80 3c 08 00 <0f> 85 75 03 00 00 49 8b 7d 18 e8 97 50 fd 01 89 c5 e9 6e fe ff ff
RSP: 0018:ffffc90001d9fe10 EFLAGS: 00000246
RAX: 1ffff110047af143 RBX: ffff8880af4fc000 RCX: dffffc0000000000
RDX: 0000000000000004 RSI: 0000000000000100 RDI: ffff888023d78a18
RBP: 0000000000000004 R08: 0000000000000100 R09: 0000000000000000
R10: ffffffff81cafef5 R11: 0000000000000000 R12: 0000000000000100
R13: ffff888023d78a00 R14: 0000000000000000 R15: 0000000000000100
sock_map_fd net/socket.c:430 [inline]
__sys_socket+0x117/0x200 net/socket.c:1505
__do_sys_socket net/socket.c:1510 [inline]
__se_sys_socket net/socket.c:1508 [inline]
__x64_sys_socket+0x6f/0xb0 net/socket.c:1508
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff15ac04188 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000010
RBP: 00000000004bfce1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007ffc2c7dc6ef R14: 00007ff15ac04300 R15: 0000000000022000
================================
WARNING: inconsistent lock state
5.12.0-rc7-syzkaller #0 Not tainted
--------------------------------
inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
syz-executor.5/14482 [HC0[0]:SC1[1]:HE0:SE0] takes:
ffffffff8bf7cad8 (rcu_node_0){?.-.}-{2:2}, at: print_other_cpu_stall kernel/rcu/tree_stall.h:541 [inline]
ffffffff8bf7cad8 (rcu_node_0){?.-.}-{2:2}, at: check_cpu_stall kernel/rcu/tree_stall.h:706 [inline]
ffffffff8bf7cad8 (rcu_node_0){?.-.}-{2:2}, at: rcu_pending kernel/rcu/tree.c:3830 [inline]
ffffffff8bf7cad8 (rcu_node_0){?.-.}-{2:2}, at: rcu_sched_clock_irq.cold+0x2b9/0x11dd kernel/rcu/tree.c:2650
{IN-HARDIRQ-W} state was registered at:
lock_acquire kernel/locking/lockdep.c:5511 [inline]
lock_acquire+0x1ab/0x740 kernel/locking/lockdep.c:5476
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:159
rcu_report_exp_cpu_mult+0x73/0x3a0 kernel/rcu/tree_exp.h:237
flush_smp_call_function_queue+0x34b/0x640 kernel/smp.c:426
__sysvec_call_function_single+0x95/0x3d0 arch/x86/kernel/smp.c:248
sysvec_call_function_single+0x8e/0xc0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:640
memset+0x0/0x40 mm/kasan/shadow.c:262
memset include/linux/fortify-string.h:175 [inline]
mm_alloc+0x39/0xc0 kernel/fork.c:1080
bprm_mm_init fs/exec.c:369 [inline]
alloc_bprm+0x1c6/0x8f0 fs/exec.c:1520
kernel_execve+0x55/0x460 fs/exec.c:1940
call_usermodehelper_exec_async+0x2de/0x580 kernel/umh.c:110
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
irq event stamp: 6742953
hardirqs last enabled at (6742952): [<ffffffff89200c02>] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
hardirqs last disabled at (6742953): [<ffffffff8909740b>] sysvec_apic_timer_interrupt+0xb/0xc0 arch/x86/kernel/apic/apic.c:1100
softirqs last enabled at (5087598): [<ffffffff81451f14>] invoke_softirq kernel/softirq.c:221 [inline]
softirqs last enabled at (5087598): [<ffffffff81451f14>] __irq_exit_rcu kernel/softirq.c:422 [inline]
softirqs last enabled at (5087598): [<ffffffff81451f14>] irq_exit_rcu+0x134/0x200 kernel/softirq.c:434
softirqs last disabled at (5087601): [<ffffffff81451f14>] invoke_softirq kernel/softirq.c:221 [inline]
softirqs last disabled at (5087601): [<ffffffff81451f14>] __irq_exit_rcu kernel/softirq.c:422 [inline]
softirqs last disabled at (5087601): [<ffffffff81451f14>] irq_exit_rcu+0x134/0x200 kernel/softirq.c:434
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(rcu_node_0);
<Interrupt>
lock(rcu_node_0);
*** DEADLOCK ***
3 locks held by syz-executor.5/14482:
#0: ffffffff8bf74520 (rcu_read_lock){....}-{1:2}, at: ieee80211_iterate_active_interfaces_atomic+0x0/0x170 net/mac80211/util.c:1291
#1: ffffffff8cd464d8 (hwsim_radio_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline]
#1: ffffffff8cd464d8 (hwsim_radio_lock){+.-.}-{2:2}, at: mac80211_hwsim_tx_frame_no_nl.isra.0+0x68f/0x1330 drivers/net/wireless/mac80211_hwsim.c:1514
#2: ffffffff8bf7cad8 (rcu_node_0){?.-.}-{2:2}, at: print_other_cpu_stall kernel/rcu/tree_stall.h:541 [inline]
#2: ffffffff8bf7cad8 (rcu_node_0){?.-.}-{2:2}, at: check_cpu_stall kernel/rcu/tree_stall.h:706 [inline]
#2: ffffffff8bf7cad8 (rcu_node_0){?.-.}-{2:2}, at: rcu_pending kernel/rcu/tree.c:3830 [inline]
#2: ffffffff8bf7cad8 (rcu_node_0){?.-.}-{2:2}, at: rcu_sched_clock_irq.cold+0x2b9/0x11dd kernel/rcu/tree.c:2650
stack backtrace:
CPU: 1 PID: 14482 Comm: syz-executor.5 Not tainted 5.12.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x141/0x1d7 lib/dump_stack.c:120
print_usage_bug kernel/locking/lockdep.c:202 [inline]
valid_state kernel/locking/lockdep.c:3819 [inline]
mark_lock_irq kernel/locking/lockdep.c:4022 [inline]
mark_lock.cold+0x61/0x8e kernel/locking/lockdep.c:4479
mark_held_locks+0x9f/0xe0 kernel/locking/lockdep.c:4080
__trace_hardirqs_on_caller kernel/locking/lockdep.c:4098 [inline]
lockdep_hardirqs_on_prepare kernel/locking/lockdep.c:4166 [inline]
lockdep_hardirqs_on_prepare+0x135/0x400 kernel/locking/lockdep.c:4118
trace_hardirqs_on+0x5b/0x1c0 kernel/trace/trace_preemptirq.c:49
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:434 [inline]
RIP: 0010:__pv_queued_spin_lock_slowpath+0x3ba/0xb40 kernel/locking/qspinlock.c:508
Code: eb c6 45 01 01 41 bc 00 80 00 00 48 c1 e9 03 83 e3 07 41 be 01 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8d 2c 01 eb 0c f3 90 <41> 83 ec 01 0f 84 72 04 00 00 41 0f b6 45 00 38 d8 7f 08 84 c0 0f
RSP: 0000:ffffc90000dc0a38 EFLAGS: 00000202
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 1ffffffff19a8c98
RDX: 0000000000000001 RSI: dffffc0000000000 RDI: ffffffff8cd464c2
RBP: ffffffff8cd464c0 R08: 0000000000000001 R09: ffffffff8cd464c3
R10: fffffbfff19a8c98 R11: 0000000000000080 R12: 00000000000079ee
R13: fffffbfff19a8c98 R14: 0000000000000001 R15: ffff8880b9d35f40
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:554 [inline]
queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
do_raw_spin_lock+0x200/0x2b0 kernel/locking/spinlock_debug.c:113
spin_lock include/linux/spinlock.h:354 [inline]
mac80211_hwsim_tx_frame_no_nl.isra.0+0x68f/0x1330 drivers/net/wireless/mac80211_hwsim.c:1514
mac80211_hwsim_tx_frame+0x14f/0x1e0 drivers/net/wireless/mac80211_hwsim.c:1775
mac80211_hwsim_beacon_tx+0x4ba/0x910 drivers/net/wireless/mac80211_hwsim.c:1829
__iterate_interfaces+0x1e5/0x520 net/mac80211/util.c:793
ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:829
mac80211_hwsim_beacon+0xd5/0x1a0 drivers/net/wireless/mac80211_hwsim.c:1852
__run_hrtimer kernel/time/hrtimer.c:1537 [inline]
__hrtimer_run_queues+0x609/0xe40 kernel/time/hrtimer.c:1601
hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1618
__do_softirq+0x29b/0x9f6 kernel/softirq.c:345
invoke_softirq kernel/softirq.c:221 [inline]
__irq_exit_rcu kernel/softirq.c:422 [inline]
irq_exit_rcu+0x134/0x200 kernel/softirq.c:434
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1100
</IRQ>
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:__schedule+0x0/0x21b0 kernel/sched/core.c:4955
Code: 5b 5d 41 5c c3 e8 c0 42 ad f8 eb d9 e8 b9 42 ad f8 e9 4b ff ff ff e8 4f 42 ad f8 e9 02 ff ff ff e8 65 42 ad f8 e9 6c ff ff ff <55> 48 89 e5 41 57 48 8d 85 78 ff ff ff 41 56 49 c7 c6 80 51 03 00
RSP: 0000:ffffc90001b1fe60 EFLAGS: 00000206
RAX: 000000000000900f RBX: ffff88801cae9c40 RCX: 1ffffffff1b8bb31
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffffed100395d388 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8179e5a8 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:5530
irqentry_exit_cond_resched kernel/entry/common.c:392 [inline]
irqentry_exit_cond_resched kernel/entry/common.c:384 [inline]
irqentry_exit+0x7a/0xa0 kernel/entry/common.c:428
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:exit_to_user_mode_loop kernel/entry/common.c:161 [inline]
RIP: 0010:exit_to_user_mode_prepare+0x10e/0x250 kernel/entry/common.c:208
Code: f6 c4 02 0f 85 0f 01 00 00 65 48 8b 04 25 00 f0 01 00 48 8b 18 f7 c3 0e 30 02 00 0f 84 2f ff ff ff e8 e6 99 17 00 fb f6 c3 08 <74> bf e8 5b b0 a8 07 f6 c7 10 74 ba 48 89 ef e8 2e 4f 33 00 f7 c3
RSP: 0000:ffffc90001b1ff30 EFLAGS: 00000202
RAX: 0000000000003bed RBX: 0000000000000008 RCX: 1ffffffff1b8bb31
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90001b1ff58 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8179e5a8 R11: 0000000000000001 R12: ffff88801cae9c40
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
irqentry_exit_to_user_mode+0x5/0x40 kernel/entry/common.c:314
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f26324fa218 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 000000000056bf68 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf68
RBP: 000000000056bf60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf6c
R13: 00007ffd9867dc8f R14: 00007f26324fa300 R15: 0000000000022000
softirq: huh, entered softirq 8 HRTIMER ffffffff8163ea80 with preempt_count 00000101, exited with 00000102?